Code Security Report: 5 high severity findings, 6 total findings [master]

[mend-for-github-com]

Code Security Report

Scan Metadata

Latest Scan: 2025-01-15 05:56pm
Total Findings: 6 | New Findings: 0 | Resolved Findings: 0
Tested Project Files: 42
Detected Programming Languages: 2 (C/C++ (Beta), Python*)

• Check this box to manually trigger a scan

Finding Details

Severity	Vulnerability Type	CWE	File	Data Flows	Detected
High	Path/Directory Traversal	CWE-22	scncopy.c:83	1	2025-01-15 05:58pm
Vulnerable Code dwarves/scncopy.c Lines 78 to 83 in 0028ef7 if (!infile || !outfile) { fprintf(stderr, "usage: pjoc -s section 0 [[-s section1] ... -s sectionN] -o outfile infile\n"); return 1; } if (!(fd = open(infile, O_RDONLY))) { 1 Data Flow/s detected dwarves/scncopy.c Line 72 in 0028ef7 infile = argv[n]; Secure Code Warrior Training Material ● Training    ▪ Secure Code Warrior Path/Directory Traversal Training ● Videos    ▪ Secure Code Warrior Path/Directory Traversal Video ● Further Reading    ▪ OWASP Path Traversal    ▪ OWASP Input Validation Cheat Sheet
High	Path/Directory Traversal	CWE-22	ctracer.c:806	1	2025-01-15 05:58pm
Vulnerable Code dwarves/ctracer.c Lines 801 to 806 in 0028ef7 return 0; } static int elf__open(const char *filename) { int fd = open(filename, O_RDONLY); 1 Data Flow/s detected dwarves/ctracer.c Line 953 in 0028ef7 case 2: filename = argv[remaining++]; dwarves/ctracer.c Line 804 in 0028ef7 static int elf__open(const char *filename) dwarves/ctracer.c Line 806 in 0028ef7 int fd = open(filename, O_RDONLY); Secure Code Warrior Training Material ● Training    ▪ Secure Code Warrior Path/Directory Traversal Training ● Videos    ▪ Secure Code Warrior Path/Directory Traversal Video ● Further Reading    ▪ OWASP Path Traversal    ▪ OWASP Input Validation Cheat Sheet
High	Buffer Overflow	CWE-121	dwarves.c:2320	1	2025-01-15 05:58pm
Vulnerable Code dwarves/dwarves.c Lines 2315 to 2320 in 0028ef7 if (n > (int)sizeof(bf)) { n = sizeof(bf); fprintf(stderr, "%s: truncating reading of build id in sysfs file %s: n_namesz=%u, n_descsz=%u.\n", __func__, filename, nhdr.n_namesz, nhdr.n_descsz); } if (read(fd, bf, n) != n) 1 Data Flow/s detected dwarves/dwarves.c Line 2311 in 0028ef7 break; dwarves/dwarves.c Line 2316 in 0028ef7 n = sizeof(bf); dwarves/dwarves.c Line 2320 in 0028ef7 if (read(fd, bf, n) != n) Secure Code Warrior Training Material ● Training    ▪ Secure Code Warrior Buffer Overflow Training ● Videos    ▪ Secure Code Warrior Buffer Overflow Video
High	Use After Free	CWE-416	libctf.c:617	2	2025-01-15 05:58pm
Vulnerable Code dwarves/libctf.c Lines 612 to 617 in 0028ef7 void *new_bf = malloc(sizeof(*hdr) + size); if (new_bf == NULL) return -ENOMEM; memcpy(new_bf, hdr, sizeof(*hdr)); memcpy(new_bf + sizeof(*hdr), bf, size); free(bf); 2 Data Flow/s detected View Data Flow 1 dwarves/libctf.c Line 617 in 0028ef7 free(bf); View Data Flow 2 dwarves/libctf.c Line 617 in 0028ef7 free(bf); Secure Code Warrior Training Material ● Training    ▪ Secure Code Warrior Use After Free Training ● Videos    ▪ Secure Code Warrior Use After Free Video
High	Double Free	CWE-415	libctf.c:617	2	2025-01-15 05:58pm
Vulnerable Code dwarves/libctf.c Lines 612 to 617 in 0028ef7 void *new_bf = malloc(sizeof(*hdr) + size); if (new_bf == NULL) return -ENOMEM; memcpy(new_bf, hdr, sizeof(*hdr)); memcpy(new_bf + sizeof(*hdr), bf, size); free(bf); 2 Data Flow/s detected View Data Flow 1 dwarves/libctf.c Line 617 in 0028ef7 free(bf); View Data Flow 2 dwarves/libctf.c Line 617 in 0028ef7 free(bf); Secure Code Warrior Training Material ● Training    ▪ Secure Code Warrior Double Free Training ● Videos    ▪ Secure Code Warrior Double Free Video
Medium	Integer Underflow	CWE-191	pahole.c:2577	2	2025-01-15 05:58pm
Vulnerable Code dwarves/pahole.c Lines 2572 to 2577 in 0028ef7 goto out; } instance = new_instance; max_sizeof = real_sizeof; } if (fread(instance + _sizeof, real_sizeof - _sizeof, 1, input) != 1) { 2 Data Flow/s detected View Data Flow 1 dwarves/pahole.c Line 2577 in 0028ef7 if (fread(instance + _sizeof, real_sizeof - _sizeof, 1, input) != 1) { View Data Flow 2 dwarves/pahole.c Line 2577 in 0028ef7 if (fread(instance + _sizeof, real_sizeof - _sizeof, 1, input) != 1) { Secure Code Warrior Training Material ● Training    ▪ Secure Code Warrior Integer Underflow Training ● Videos    ▪ Secure Code Warrior Integer Underflow Video